safe-shell-execution-claude-code

• Outcome: Pass
• Latest audit: May 28, 2026 · 2:28 PM UTC
• Version: 1.0.0

Overview

This is an instruction-only shell safety checklist with no executable payload, though users should tighten its handling of very destructive commands for stricter environments.

Safe to install as a guardrail or checklist, not as a complete enforcement policy. Before relying on it, consider changing local rules to reject root or broad recursive deletion, block unsafe force pushes and --no-verify by default, and require explicit human review for sensitive file writes.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### File System

```
rm -rf / rm -fr / rm -r -f / rm -f -r  → "May recursively force-delete files"
```

---

• Confidence: 88% confidence
• Finding: This duplicate finding refers to the same `rm -rf` destructive pattern. In the context of an agent skill for shell execution, allowing recursive forced deletion after only confirmation is insufficient because small parsing mistakes or malicious prompting can cause severe, irreversible filesystem damage.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git stash drop / clear        → "May permanently delete stashed content"
git branch -D                 → "May force-delete a branch"
git commit --amend            → "May rewrite the last commit"
git commit/push --no-verify   → "May skip security hooks"
```

### File System

• Confidence: 90% confidence
• Finding: The skill allows `git commit/push --no-verify` after only a warning, despite explicitly noting that it can skip security hooks. In environments relying on client-side checks to prevent secret leakage, policy violations, or unsafe commits, permitting this flag with minimal friction can enable bypass of important safeguards.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### File System

```
rm -rf / rm -fr / rm -r -f / rm -f -r  → "May recursively force-delete files"
```

---

• Confidence: 88% confidence
• Finding: This duplicate finding refers to the same `rm -rf` destructive pattern. In the context of an agent skill for shell execution, allowing recursive forced deletion after only confirmation is insufficient because small parsing mistakes or malicious prompting can cause severe, irreversible filesystem damage.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```
git reset --hard              → "May discard all uncommitted changes"
git push --force / -f         → "May overwrite remote history"
git clean -f (without -n flag) → "May permanently delete untracked files"
git checkout -- .             → "May discard all workspace changes"
git restore .                 → "May discard all workspace changes"

• Confidence: 79% confidence
• Finding: `git push --force` is only gated by a warning and confirmation, but force-push can rewrite shared history and destroy collaborators' work. In an autonomous or semi-autonomous agent setting, weak confirmation controls may not adequately prevent accidental or manipulated destructive repository operations.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Git Operations

```
git reset --hard              → "May discard all uncommitted changes"
git push --force / -f         → "May overwrite remote history"
git clean -f (without -n flag) → "May permanently delete untracked files"
git checkout -- .             → "May discard all workspace changes"

• Confidence: 78% confidence
• Finding: `git reset --hard` is classified as confirmable rather than disallowed, even though it can permanently discard uncommitted work. In an agent context, destructive source-control commands are risky because the model may not fully understand workspace state or user intent, leading to irreversible loss.

Static analysis

No suspicious patterns detected.